I believe that you only need to pass in the token (your step #3) the first time. What happens when you remove the token for subsequent calls? Then does this help?
If you are using embedded dashboard and refreshing the browser, then you need to request a new auth token. The auth token is rendered void after being used to initialize the viz iframe.